Fallos del tipo CWE-226

33 resultados

Informação sensível não removida antes de reutilizar recurso

Ocorre quando um recurso (memória, arquivo, buffer) que continha dados sensíveis é reutilizado sem limpeza prévia. Um atacante pode recuperar dados anteriores (senhas, tokens, dados pessoais) lendo o recurso antes de ser sobrescrito. O risco é alto em ambientes compartilhados ou quando o recurso é alocado a outro usuário/processo.

Ejemplo

Um servidor web reutiliza um buffer para processar requisições de múltiplos clientes. Se não limpar o buffer entre requisições, o cliente B pode ler resquícios do token JWT ou senha do cliente A que estava no mesmo espaço de memória.

Cómo mitigar

Sempre zerar ou sobrescrever dados sensíveis (memória, strings) imediatamente após uso, antes de liberar o recurso. Use funções explícitas de limpeza (como `memset_s()` em C, ou `SecureString` em .NET) e evite confiar em garbage collection para dados críticos.

CVE-2020-27218—In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request boEPSS 8.1%CVE-2018-7166—In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This mEPSS 3.2%CVE-2022-39393HIGHWasmtime vulnerable to data leakage between instances in the pooling allocatorEPSS 0.7%CVE-2024-32036MEDIUMSixLabors.ImageSharp vulnerable to data leakageEPSS 0.6%CVE-2026-5795HIGHIn Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning froEPSS 0.5%CVE-2019-25560HIGHLyric Video Creator 2.1 Denial of Service via MP3 FileEPSS 0.5%CVE-2024-7883LOWCMSE secure state may leak from stack to floating-point registersEPSS 0.5%CVE-2026-47247HIGHlibheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane AllocationEPSS 0.4%CVE-2024-38275HIGHmoodle: HTTP authorization header is preserved between "emulated redirects"EPSS 0.4%CVE-2026-13585HIGHAllocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System ContEPSS 0.3%CVE-2025-11602MEDIUMUntargeted information leak in Bolt protocol handshakeEPSS 0.3%CVE-2019-1573LOWInformation Disclosure in GlobalProtect AgentEPSS 0.3%CVE-2023-3006MEDIUMA known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOEPSS 0.3%CVE-2026-32960HIGHSD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a sensitive information in resource not removed before reuEPSS 0.3%CVE-2025-2522MEDIUMLack of buffer clearing before reuse may result in incorrect system behavior.EPSS 0.2%CVE-2023-1637MEDIUMA flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the Linux kernel X86 CPU Power managementEPSS 0.2%CVE-2024-21850HIGHSensitive information in resource not removed before reuse in some Intel(R) TDX Seamldr module software before version 1.5.02.00 may allow aEPSS 0.2%CVE-2019-25657MEDIUMAnyBurn 4.3 x86 Denial of Service via Image ConversionEPSS 0.2%CVE-2025-13108MEDIUMFixes to common vulnerabilities found in IBM Db2 Merge Backup for Linux, UNIX and WindowsEPSS 0.2%CVE-2019-25563MEDIUMPCHelpWareV2 1.0.0.5 Denial of Service via SC CreationEPSS 0.2%